Microsoft ≫ Visual Studio Code

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace.

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.

Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.

Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.

Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability